Drata Reviews & Product Details

Pros: Excellent compliance automation platform with a clean interface and strong integrations. It has helped simplify audit preparation and ongoing compliance management.

Cons: Customer support has deteriorated significantly. We were initially promised human support, but most interactions are now handled by AI agents that provide repetitive and often unhelpful responses. Instead of solving problems quickly, support frequently wastes time and creates frustration.

Overall: Great platform, but the support experience has become its biggest weakness. Review collected by and hosted on G2.com.

The biggest issue with Drata is, without question, its customer support. When we purchased the platform, we were promised access to knowledgeable human support representatives who could provide timely and meaningful assistance. That commitment appears to have disappeared.

Today, nearly every support interaction is handled by AI agents that repeatedly provide generic, canned responses that rarely address the actual issue. Instead of helping customers resolve problems, the support process often forces us to spend additional time explaining the same issue over and over again while receiving the same unhelpful answers.

Frankly, Drata's support has become a nightmare. What was once a differentiator has turned into the platform's biggest weakness. The product itself is good, but when customers need help, the lack of effective human support creates frustration, delays, and a poor overall experience.

If Drata wants to maintain customer trust, it needs to bring back accessible, knowledgeable human support instead of relying almost entirely on AI-driven responses. Review collected by and hosted on G2.com.

I like how Drata provides clear visibility into our compliance posture, simplifies auditor interactions, and keeps ISO 27001, SOC 2, and other compliance initiatives organized and audit-ready year-round, not just at audit time. Review collected by and hosted on G2.com.

One area that could be improved is navigation and workflow continuity. When working through auditor requests, it's easy to lose your place if you need to create or update related items such as controls or evidence. For example, if I open an auditor request, add a control, and then add evidence, there isn't always a clear path back to the original request. I often use multiple browser tabs to maintain context and avoid losing my place. This is a relatively minor issue, but improving navigation between related records would make audit workflows more efficient. Review collected by and hosted on G2.com.

I like the thoughtfully designed UI, the AI chatbot, and the relatively fast human support. The integrations with other tools still have room for improvement, but overall, it’s been a better experience than some competitors. I also appreciate Drata Autopilot and how easy it is to quickly test integrations to confirm their capabilities and performance. Review collected by and hosted on G2.com.

There are some limitations in how the integrations are designed. With certain tools, the integrations leave you with very little control, and the available capabilities remain fairly high-level. In most cases, though, they make up for that with support.

That said, I think the scope of onboarding and the accelerator program is also too high-level. They help you collect some standard documents and fill in general fields in your Drata setup, but those aren’t the real pain points. They also provide generic policy templates. If you have zero policies in your business, you could try to implement what’s in those templates as your policies. However, if you already have policies in place, there’s little value in the provided templates.

If they took the time to understand your business and your current state, and then helped you align your existing policies with the requirements, that would make for a much better accelerator program experience. Overall, Drata is a great tool if you already know or understand what you need to do to achieve compliance, and it works well for us. Review collected by and hosted on G2.com.

It made the whole SOC 2 process so much easier by helping us gather all the evidence we needed. I also liked the simple policy templates that were included. Before we started working with Drata, we tried writing our own policies, and it turned into a contentious, difficult process. The Drata policies were straightforward and clean, and it was much easier to get consensus around them. Yes, between the man hours it has saved us, the reduction of stress and the clarity it brings to the process makes it worth it. Review collected by and hosted on G2.com.

Least helpful is that some of the tests are inconsistent sometimes. For example, the data client would often report that a user's hard drive was not encrypted one day but then was encrypted the next day. These issues were fixed by Drata but I would consider it to be pretty minor. Also, it is sometimes hard to figure out how to customize specific tests. For example, Control DCF-71 Unique Accounts Used tied to the Employees have unique infrastructure accounts. We use Google Workspace for internal access, all employees are set up in Google Workspace with their unique accounts. We also have a connector to Azure where our product lives, in Azure we also have client accounts for our end users as well as accounts for our employees. It always flags the user accounts on Azure as failing because it doesn't tie to the Google Workspace connector. I then have to manually add an exception for each client. I haven't been able to figure out a way to change any settings to change this behavior. Review collected by and hosted on G2.com.

Drata has been an essential part of our compliance workflow since 2023. What stands out most is how intuitive the platform is, from continuous monitoring to audit prep, everything is laid out in a way that makes even complex compliance processes feel manageable. The integrations are seamless and have saved us countless hours by automating what used to be very manual work. Performance-wise, the platform is consistently reliable and responsive. But what truly sets Drata apart is their customer service; their team is exceptional, always quick to respond and knowledgeable. For any company navigating SOC 2 compliance, Drata is an investment that pays for itself. Review collected by and hosted on G2.com.

The initial setup can feel a bit overwhelming given the breadth of the platform, but once you take the time to familiarize yourself and explore, it becomes much more manageable. It's less of a flaw and more of a natural learning curve for a tool this comprehensive. Review collected by and hosted on G2.com.

I love how Drata simplifies managing certifications for quality like SOC and GDPR. It's outstanding in simplifying the startup process with templates and an AI-driven help center that offers ideas and documentation insights. The platform keeps everything in one easy-to-navigate place, replacing the need for multiple spreadsheets and shared drives. The setup is quick, with ongoing management made easy through reminders and a user-friendly interface. The UI/UX is exceptional, and the platform provides excellent tools for managing workload. I love the clear layout, utilizing color codes to easily track subcomponents in sections. The risk assessment section is particularly valuable, allowing me to manage everything in one place with quick progress checks and vendor reviews. The automated evidence collection saves time and enhances event tracking. I also appreciate the quick start program that got us running in no time, highlighting how easy and swift it is to integrate Drata into our workflow. Review collected by and hosted on G2.com.

It's really tricky to find something that doesn't work pretty well. Based on the other systems I've ever used, there's not anything that doesn't work well. However, I would like to see more connections in the connection section. There are huge numbers of vendors and suppliers or new programs coming online for connectivity, and I would love to see them catch up on the connections and add more potential available connections. Specifically in observability, there's only Datadog and New Relic, and these two companies do not connect well unless you're at their absolute top level service. There's a lot better options than Datadog and New Relic, so I'd love to see the observability specific connections branch out and offer more choices. Review collected by and hosted on G2.com.

What I like best about Drata is that it takes a lot of the manual work out of compliance. We’re a pretty lean organization at Waterly, so having one place that keeps track of controls, evidence, policies, integrations, and audit prep is a big deal.

For me, the biggest value is being able to stay on top of SOC 2 without having to constantly manage spreadsheets or chase down evidence. It gives me a quick view of where we stand, what needs attention, and helps us stay audit-ready without needing a whole compliance team. Review collected by and hosted on G2.com.

I'd say the Vendor management. I feel like it creates a ridged structure that I'd appreciate more flexibility with. I would also like to see registers for departments, job titles, systems, and processes within Drata. Review collected by and hosted on G2.com.

The best feature of Drata is that it helps you organize all the controls you need in place - in order to be certified accoring to the certification of your choice. If your employees haven't read the required policies or performed the training they were supposed to do, Drata will remind them or you can easily go into the dashboard to see who you need to chase.

Another thing that stands out is its beautiful design. It really is one of the better softwares from en esthetic point of view. The intiutive GUI makes Drata easy to use and the many ready-made templates make the the implementaion easy.

Compliance can be complicated but the chat function with customer support is really quick and the people there are knowledgeable and respond quickly to any technical or compliance related questions.

Frequency of Use: When you implement Drata, you need to use it a lot. But once up and running, I use Drata more as a tool to follow up any gaps towards being certified.

I also really like that Drata has made it easy to share our compliance work with potential customers in a "trust center". Here you can tailor what you show to your customers and share all the information you want by sending them a URL. We try to do this before onbaording a new customer to eliminate a tedious compliance process from the customer's side. Review collected by and hosted on G2.com.

Some of the evidence is static and you can "fool" Drata by uploading something that is not real evidence. However, there are more and more integrations towards other systems, which makes evidence live and up to date. Review collected by and hosted on G2.com.

What I like best about Drata is how it centralizes compliance activities and makes it easier to keep track of requirements, evidence, and overall compliance status in one place. The automated monitoring and integrations reduce a lot of the manual follow-up involved in gathering evidence, while the clear dashboards make it easy to identify gaps and understand what needs attention. Overall, it helps make compliance work more organized, efficient, and manageable. Review collected by and hosted on G2.com.

One area that could be improved is the overall UI/UX, as some workflows and settings can take a bit of time to navigate or understand, especially when you’re looking for something specific. Integrations are helpful, but occasionally require additional troubleshooting or manual follow-up when evidence doesn’t sync as expected. More intuitive navigation, clearer guidance within the platform, and greater visibility into integration or sync issues would make the experience even smoother. Review collected by and hosted on G2.com.

It is simple and easy to use. It covers a lot of security controls and requirements making it easy to sync with multiple employees on compliance requirements. The pricing is a very easy sell to the leadership team, especially compared to some of the other solutions we vetted. I like that it includes a trust center. Also the trust center was fairly easy to setup. Review collected by and hosted on G2.com.

When there is an error such as when we auto-populated data through a test. When the test is failing and you click into the test to see what part of it is failing and the page hits an error. This can happen continuously to where you have a control that is failing and no way to see what is causing it to fail. Review collected by and hosted on G2.com.